Asp.Net Core DataProtection between Web Apps not working on Azure

Question

I have two WebApps on Azure running on the Free tier service plan. There's a scenario where I generate an Identity reset password token from WebApp A and use it in the WebApp B.

In my Startup.cs I have the DataProtection setup as follows in the ConfigureServices method:

services.AddDataProtection().SetApplicationName("appname");

It runs fine locally, but when I try to reset the password in this scenario I get an Invalid Token error message on Azure.

I'm running ASP.NET Core 2.1 with Identity Core. Is there any Azure restriction for this DataProtection setup or something to do with the free tier service plan?

Thanks!

Answer 1

There are some differences in how the APS.NET (Core) works on the IIS server and on the Azure Web Apps. While it is not exactly the restriction (you would get some error in that case), some things technically don't work. As far as I have read you don't have your own virtual server in Web Apps, but rather there is a pool of servers where at any time any server can be dedicated to your task. This makes some of the things not working properly and if you detected the difference it is almost certainly due to this.

Also of note, testing if it is limited to the free tier will cost you less than 1$, so it is probably better idea to test that than to ask it, just I am not aware of any API limitations of the free tier.

Answer 2

If you want to share cookie between application ASP.Net core ASP.net application try this article https://docs.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-2.2 `

services.AddDataProtection()
    .PersistKeysToFileSystem(GetKeyRingDirInfo())
    .SetApplicationName("SharedCookieApp");

services.ConfigureApplicationCookie(options => {
    options.Cookie.Name = ".AspNet.SharedCookie";
});`